According to Reuters, Uber was said to have paid hackers US$100,000 to destroy the data, not telling riders or drivers whose information was at risk.
An Uber spokesperson said the company expected to have ongoing discussions with regulatory and government authorities on the matter.
“Until we complete that process, we aren’t in a position to get into any more details.”
Stolen files included the names, email addresses and mobile phone numbers of riders, and the names and drivers licence information of some 600,000 drivers, Uber said.
The data breach was first reported by Bloomberg on Tuesday.
Reuters said hackers previously stole information about Uber drivers, and that the company acknowledged in 2014 that its employees had used a software tool called “God View” to track passengers.